Using Memory Map Timings to Discover Information Leakage to a Live VM from the Hypervisor

In this paper we present a technique for detecting information leaked from the hypervisor to the guest OS via statistical analysis of the amount of time required to map and unmap a page in memory. Analysis of these timings allows a guest to determine the number of co-located VMs on the same physical hardware as well as determine whether or not the VM is being monitored by Virtual Machine Introspection.